Persistence in Windows

SoK: Systematization, Detection, and Hunting of Windows Malware Persistence Techniques

Only 55.2% of samples are persistent.
Contrary to the general expectation that the vast majority of active malware requires persistence.
Absence of running malware does not prove that no execution occurred—malware may exfiltrate data and delete itself without being resident

Over 30% employ two or more persistence techniques
Removing a single vector may not fully eradicate the malware.
We identified 42 distinct methods out of 72 documented, highlighting a long-tail distribution. The top 10 techniques cover many families, but full detection requires attention to rarer methods.
Malware families often switch persistence techniques over time.
Knowing the family and its typical behavior doesn’t guarantee knowledge of the specific technique used.
Only 43.2% aim for execution at boot.
Although persistence is often equated with boot-time execution, many samples prefer to trigger on system events, schedules, or user actions.

Although monitoring Windows API calls is effective for most techniques we documented, attackers can exploit less commonly monitored Windows subsystems to achieve the same effect more stealthily.
Another common evasion strategy is the obfuscation of Registry and file system paths.

While persistence detection is generally considered a solved problem, we reveal that industry-standard persistence detection tools produce a significant number of false positives and false negatives.
Our analysis of state-of-the-art tools reveals that:
Capa 72.5% false positives, 42.1% false negative rate (FNR). Triage unknown files, guide reverse engineering, and hunt across a corpus for novel malware. In contrast to YARA, which primarily searches for sequences of bytes, capa rules describe features at the code-level.
Autoruns 24.9% FNR. This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login…Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more.
Persistence Sniper a 34.9% FNR. Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.